Does GPSR Apply to Digital Products or Software?

Many online sellers offer a mix of physical goods and digital downloads, so a natural question is whether the https://prestashopcompliance.com/eu-laws/gpsr/ reaches software, e-books, subscriptions or other purely digital products. The short answer is that the Regulation is aimed at physical consumer products, but the boundary deserves a closer look. What the Regulation Is Built Around The General Product Safety Regulation applies to non-food consumer products placed on the EU market, covering new, used, repaired and refurbished items. Its concept of safety is grounded in physical characteristics: how a product is made, its composition, its packaging and the instructions that accompany it. A file that a customer downloads, with no tangible article behind it, generally does not fit that framework. Pure Digital Goods: Usually Out of Scope Standalone software licences and apps sold as downloads.E-books, digital templates and online courses.Streaming or subscription access with no physical item. These are typically addressed by other EU rules on digital content and services rather than the https://prestashopcompliance.com/faqs/what-is-gpsr/ product-safety regime. Where Digital and Physical Meet The picture changes once software is embedded in, or connected to, a physical product. A smart speaker, a fitness tracker or a connected toy is still a physical consumer product, and its safety can depend on the software it runs and on the updates that keep it safe. In that context, the digital element is part of assessing whether the physical product is safe, so the Regulation is relevant even though the code itself is not the product. The practical takeaway: if you sell purely digital goods, the GPSR usually will not apply to them, but if your product is a physical device with software inside it, treat it as an in-scope product and document its safety accordingly. This answer is for general education and does not constitute legal advice.

Do I Need an EU Responsible Person If I Only Sell in My Own Country?

A common misunderstanding is that the responsible-person requirement only bites when you ship across borders. In fact, it does not depend on how far your parcels travel. What matters under the https://prestashopcompliance.com/eu-laws/gpsr/ is where the product was made and who first places it on the Union market. The Test Is the Product's Origin, Not Your Delivery Radius The General Product Safety Regulation says a product may only be placed on the market if an economic operator established in the EU is responsible for it. This flows from Regulation (EU) 2019/1020, Article 4. The trigger is a product manufactured outside the Union that reaches EU consumers. If you import goods from outside the EU and then sell them, even only to customers in your own country, you have placed those goods on the Union market and a https://prestashopcompliance.com/glossary/responsible-person/ is required. When You Probably Do Need One You import products from outside the EU and resell them domestically.You dropship items shipped directly from a non-EU manufacturer.You sell own-brand goods manufactured for you outside the Union. When It May Already Be Covered If you buy products from an EU-based manufacturer or importer, that upstream operator is usually the responsible person, and their details should appear in your https://prestashopcompliance.com/faqs/what-is-gpsr/ compliant listings. You still have to show that information under Article 19, but you may not need to appoint anyone yourself. The safest approach is to confirm in writing which party in your supply chain holds the role. So domestic-only selling is not an exemption. The question is always: was this product made outside the EU, and is there already an EU operator responsible for it? If not, that responsibility falls to you. This answer is for general education and does not constitute legal advice.

Which Country's Rules Apply When I Sell Across the EU?

The short answer: EU-wide regulations give you a single baseline that applies everywhere, but a number of national obligations follow the country you are selling into. When you ship across the EU, you meet the EU rules once, then add the destination country's specifics for each market you serve. EU-wide regulations are the baseline Regulations such as the GPSR (product safety), the Omnibus rules (price transparency and reviews), the PPWR (packaging) and the European Accessibility Act apply across all 27 member states. Their core requirements - a safe product, a responsible person in the EU, honest price reductions, accessible e-commerce - do not change from one country to the next. Get these right and you have your common foundation for the whole single market. National transposition adds detail Where EU rules take the form of directives, each country writes them into national law and can add detail. Germany's price-display rules sit in the Preisangabenverordnung; Italy's consumer rules are in the Codice del Consumo; Spain uses the Texto Refundido consumer statute; France layers on strong consumer-protection practice. The substance is harmonised, but the exact wording, disclosures and enforcement bodies are national. Language follows the customer Consumer information must generally be in the language of the destination country: French for France (the Toubon law), Italian for Italy, Spanish (and sometimes co-official regional languages) for Spain, German for Germany. This covers product descriptions, safety warnings, instructions and the required pre-contractual information. A single English storefront is not enough for these markets. EPR is per destination country Extended Producer Responsibility registrations are national and depend on where your goods and packaging end up. If you ship to Germany, you register in the LUCID packaging register before selling. If you ship to France, you deal with the REP system and a unique identifier via ADEME, plus packaging EPR. Italy uses CONAI; Spain applies Royal Decree 1055/2022. You need the right EPR registration for each destination country you supply, not one blanket registration. In practice Meet the EU-wide regulations once as your baseline.For each destination country, add local language, transposition detail and EPR registration.Confirm specifics with the named national authority, as they change over time. See our country hubs for France, Italy, Spain and Germany for the destination-specific detail.

What are the penalties for GPSR non-compliance?

There is no single EU-wide penalty figure for GPSR breaches. The regulation requires penalties to be effective, proportionate and dissuasive, but leaves the actual sanctions to each Member State to set under national law. This means the fines and other consequences you face depend on which country's authority is enforcing, so a breach affecting sales in several markets can expose you to several national regimes at once. Financial penalties are only part of the picture. Market surveillance authorities have a range of powers that can be more disruptive to an online store than a fine: Withdrawal or recall — authorities can order a dangerous product to be taken off the market or recalled from consumers.Safety Gate listing — dangerous products can be published on the EU Safety Gate rapid alert system (formerly RAPEX), visible across all Member States.Marketplace takedowns — online marketplaces must act on notices about dangerous products, so listings can be removed and seller accounts restricted.Sales bans and destruction — in serious cases authorities can prohibit supply or require products to be destroyed. For PrestaShop merchants, the practical takeaway is that non-compliance risks losing the ability to sell a product entirely, not just a monetary penalty. Check the enforcement notes for your main markets, such as Germany and France, and work through the Complete GPSR Guide to reduce your exposure.

Does GPSR apply to dropshipping?

Yes, the GPSR applies to dropshipping. The regulation covers online and distance selling regardless of how the goods are fulfilled or where the seller is based. Dropshipping does not create an exemption; it simply changes who occupies which role in the supply chain. The key question is which economic operator role you occupy. If you list and sell products to EU consumers under your own store, and your supplier is outside the EU, you may be treated as the importer — or even the manufacturer if you sell under your own brand. Either role carries substantial duties, including ensuring the product is safe, documented and traceable. See our glossary entry on the economic operator. Crucially, a product may not be placed on the EU market unless there is a responsible person established in the EU. A dropshipper sourcing from outside the EU cannot rely on the overseas supplier to satisfy this. You must ensure an EU responsible person exists — an importer, authorised representative or qualifying fulfilment service provider — and display their details on your listings alongside the manufacturer's contact information, product identifiers and any warnings. In short, dropshipping models that source directly from non-EU suppliers face some of the hardest GPSR compliance challenges. Before scaling such a model, work through the requirements in the Complete GPSR Guide and confirm you can meet the distance-selling information rules for every product you list.

Guide

GPSR in Spain: What PrestaShop Sellers Must Do

By Compliance Editorial Team Updated July 4, 2026 5 min read

GPSR

Selling physical consumer products into Spain through PrestaShop means meeting the General Product Safety Regulation (GPSR) — the EU-wide rulebook for product safety and online sales. The obligations themselves are identical across the EU, but Spain has two distinctive practical features: a devolved system of consumer authorities, and a set of co-official regional languages alongside Spanish. This guide covers the GPSR baseline and then the Spain-specific points a PrestaShop merchant should act on.

Read this together with our GPSR overview and the in-depth complete GPSR guide. For the wider Spanish market, including packaging and consumer-law considerations, see our Spain country hub.

The GPSR baseline

The GPSR is Regulation (EU) 2023/988 and has applied since 13 December 2024. As a regulation it applies directly and uniformly in Spain, with no separate national version of the core duties. It modernised EU product-safety law and, importantly for e-commerce, introduced explicit online-sales obligations.

The headline duties for a merchant are: only place safe products on the market; ensure an EU-based responsible person exists for each product; provide the required safety and traceability information; cooperate with market-surveillance authorities; and take corrective action, including via the EU Safety Gate, when a product is unsafe.

The EU responsible person

An in-scope product may be placed on the EU market only if there is an economic operator established in the EU responsible for it — typically an EU manufacturer, importer, authorised representative, or in some cases a fulfilment service provider. If your products originate outside the EU, you must make sure this responsible person exists before offering the goods to Spanish consumers. This is a precondition for selling in-scope products at all, not an optional extra.

Article 19 online information

The GPSR requires certain information to appear in the online offer before purchase: details identifying the product; the manufacturer’s name and contact details (including an electronic address); where the manufacturer is outside the EU, the EU responsible person’s details; and any relevant warnings or safety information. On PrestaShop, this is fundamentally a product-page task — the information must be visible on the listing itself.

Spain’s devolved consumer authorities

Spain’s most distinctive enforcement feature is that consumer protection is devolved to the autonomous communities (comunidades autónomas). Rather than a single central regulator handling everything, each region has its own consumer authorities, coordinated nationally. In practice this means the authority you deal with can depend on where the consumer is located, while national-level bodies provide coordination and Spain participates in EU-wide market surveillance and the Safety Gate.

For a PrestaShop merchant, the operational takeaway is not to master every regional structure, but to be ready to respond to whichever authority contacts you. Keep your responsible-person details, technical and safety documentation, and corrective-action process organised so you can react promptly regardless of which regional or national body raises a query. A devolved system means more potential points of contact, so consistency and good record-keeping matter even more.

Language: Spanish and co-official regional languages

Safety-relevant information — warnings, safe-use instructions, and other information the consumer needs — must be provided in a language the Spanish consumer readily understands. In practice that means Spanish (Castilian) as the baseline. Spain also has co-official languages in several regions — such as Catalan, Galician, Basque and Valencian — and regional consumer rules can, in some contexts, expect information in the relevant co-official language.

Provide warnings and safe-use instructions in Spanish as your reliable baseline for the whole Spanish market.
Be aware that co-official regional languages may be expected in certain regions and contexts; assess this for the areas you actively target.
Ensure translations are accurate — a mistranslated safety warning is worse than no translation, and machine output should be checked.
Hold the language variants in PrestaShop’s multi-language fields so the correct text appears on the Spanish storefront.

Because the language picture is more nuanced than in a single-language country, err towards clear, complete Spanish and treat co-official languages as a regional refinement where you have meaningful sales into those communities.

Implementing it in PrestaShop

Product-page data

Set up each in-scope product so the Spanish storefront shows the manufacturer’s details, the EU responsible person’s details where applicable, and Spanish-language warnings and safe-use information. Using structured fields or a consistent template reduces the risk of a listing silently missing a required element — a common failure mode when this is done manually across a large catalogue.

Documentation and readiness

Keep technical and safety documentation for in-scope products, ready for any Spanish regional or national authority.
Record the responsible person for each product line and keep those details current.
Maintain a corrective-action and Safety Gate process for withdrawing or recalling unsafe products.

Multi-store and multi-language

If Spain is one of several EU markets served from a single PrestaShop installation, use multi-store and multi-language so the Spanish storefront carries Spanish (and, where relevant, co-official language) safety information, while other storefronts present their own market’s language. The underlying GPSR obligations are identical; the presentation must match the market.

Spain GPSR checklist

Confirm each in-scope product has an EU responsible person before offering it in Spain.
Display Article 19 information on every Spanish product listing.
Provide Spanish-language warnings and instructions, and consider co-official languages for targeted regions.
Keep documentation and traceability ready for devolved and national authorities alike.
Maintain a corrective-action / Safety Gate process for unsafe products.

Handle these consistently and GPSR compliance for Spain becomes routine rather than reactive. Begin with the GPSR overview, follow the complete GPSR guide, and use the Spain hub for the broader Spanish requirements that accompany product safety.

This guide is provided for educational purposes only and does not constitute legal advice. The GPSR applies EU-wide, but enforcement in Spain is devolved and language expectations vary by region and change over time. Consult a qualified lawyer in Spain before making compliance decisions for your business.

Official reference: https://eur-lex.europa.eu/eli/reg/2023/988/oj